1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2001-2002 Sun Microsystems, Inc. 24*0Sstevel@tonic-gate * All rights reserved. 25*0Sstevel@tonic-gate * Use is subject to license terms. 26*0Sstevel@tonic-gate */ 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 29*0Sstevel@tonic-gate 30*0Sstevel@tonic-gate #include <netdb.h> 31*0Sstevel@tonic-gate #include <netinet/in.h> 32*0Sstevel@tonic-gate #include <pwd.h> 33*0Sstevel@tonic-gate #include <sys/errno.h> 34*0Sstevel@tonic-gate #include <sys/mutex.h> 35*0Sstevel@tonic-gate #include <sys/param.h> 36*0Sstevel@tonic-gate #include <sys/socket.h> 37*0Sstevel@tonic-gate #include <sys/stat.h> 38*0Sstevel@tonic-gate #include <sys/types.h> 39*0Sstevel@tonic-gate #include <string.h> 40*0Sstevel@tonic-gate #include <unistd.h> 41*0Sstevel@tonic-gate #include <stdlib.h> 42*0Sstevel@tonic-gate #include <sys/smedia.h> 43*0Sstevel@tonic-gate #include "smserver.h" 44*0Sstevel@tonic-gate #include <bsm/audit.h> 45*0Sstevel@tonic-gate #include <bsm/libbsm.h> 46*0Sstevel@tonic-gate #include <bsm/audit_uevents.h> 47*0Sstevel@tonic-gate #include <bsm/audit_record.h> 48*0Sstevel@tonic-gate 49*0Sstevel@tonic-gate /* Private Functions */ 50*0Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int); 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate static int audit_selected(door_data_t *); 53*0Sstevel@tonic-gate static int audit_na_selected(door_data_t *); 54*0Sstevel@tonic-gate static int audit_save_namask(door_data_t *door_dp); 55*0Sstevel@tonic-gate static int audit_save_policy(door_data_t *door_dp); 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate /* 58*0Sstevel@tonic-gate * can_audit: 59*0Sstevel@tonic-gate * Return 1 if audit module is loaded. 60*0Sstevel@tonic-gate * Return 0 otherwise. 61*0Sstevel@tonic-gate * 62*0Sstevel@tonic-gate */ 63*0Sstevel@tonic-gate int 64*0Sstevel@tonic-gate can_audit(void) 65*0Sstevel@tonic-gate { 66*0Sstevel@tonic-gate static int auc = AUC_UNSET; 67*0Sstevel@tonic-gate int cond = 0; 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) { 70*0Sstevel@tonic-gate auc = AUC_DISABLED; 71*0Sstevel@tonic-gate } else { 72*0Sstevel@tonic-gate auc = cond; 73*0Sstevel@tonic-gate } 74*0Sstevel@tonic-gate if (auc == AUC_DISABLED) 75*0Sstevel@tonic-gate return (0); 76*0Sstevel@tonic-gate else return (1); 77*0Sstevel@tonic-gate } 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate static int 80*0Sstevel@tonic-gate audit_save_policy(door_data_t *door_dp) 81*0Sstevel@tonic-gate { 82*0Sstevel@tonic-gate int policy; 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) { 85*0Sstevel@tonic-gate return (-1); 86*0Sstevel@tonic-gate } 87*0Sstevel@tonic-gate door_dp->audit_policy = policy; 88*0Sstevel@tonic-gate return (0); 89*0Sstevel@tonic-gate } 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate /* 92*0Sstevel@tonic-gate * audit_init(): 93*0Sstevel@tonic-gate * Initialize variables. 94*0Sstevel@tonic-gate */ 95*0Sstevel@tonic-gate void 96*0Sstevel@tonic-gate audit_init(door_data_t *door_dp) 97*0Sstevel@tonic-gate { 98*0Sstevel@tonic-gate door_dp->audit_auid = -1; 99*0Sstevel@tonic-gate door_dp->audit_uid = -1; 100*0Sstevel@tonic-gate door_dp->audit_euid = -1; 101*0Sstevel@tonic-gate door_dp->audit_gid = -1; 102*0Sstevel@tonic-gate door_dp->audit_egid = -1; 103*0Sstevel@tonic-gate door_dp->audit_pid = -1; 104*0Sstevel@tonic-gate door_dp->audit_tid.at_port = 0; 105*0Sstevel@tonic-gate door_dp->audit_tid.at_type = 0; 106*0Sstevel@tonic-gate door_dp->audit_tid.at_addr[0] = 0; 107*0Sstevel@tonic-gate door_dp->audit_tid.at_addr[1] = 0; 108*0Sstevel@tonic-gate door_dp->audit_tid.at_addr[2] = 0; 109*0Sstevel@tonic-gate door_dp->audit_tid.at_addr[3] = 0; 110*0Sstevel@tonic-gate door_dp->audit_namask.am_success = (int)-1; 111*0Sstevel@tonic-gate door_dp->audit_namask.am_failure = (int)-1; 112*0Sstevel@tonic-gate door_dp->audit_event = 0; 113*0Sstevel@tonic-gate door_dp->audit_sorf = -2; 114*0Sstevel@tonic-gate door_dp->audit_user = NULL; 115*0Sstevel@tonic-gate door_dp->audit_text[0] = NULL; 116*0Sstevel@tonic-gate door_dp->audit_text1[0] = NULL; 117*0Sstevel@tonic-gate door_dp->audit_na = 0; 118*0Sstevel@tonic-gate door_dp->audit_asid = -1; 119*0Sstevel@tonic-gate door_dp->audit_path = NULL; 120*0Sstevel@tonic-gate } 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate int 123*0Sstevel@tonic-gate audit_save_me(door_data_t *door_dp) 124*0Sstevel@tonic-gate { 125*0Sstevel@tonic-gate door_cred_t client_cred; 126*0Sstevel@tonic-gate int ret_val; 127*0Sstevel@tonic-gate int i; 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate ret_val = door_cred(&client_cred); 130*0Sstevel@tonic-gate if (ret_val == -1) 131*0Sstevel@tonic-gate return (ret_val); 132*0Sstevel@tonic-gate door_dp->audit_ap.ap_pid = client_cred.dc_pid; 133*0Sstevel@tonic-gate ret_val = auditon(A_GETPINFO_ADDR, (caddr_t)&door_dp->audit_ap, 134*0Sstevel@tonic-gate sizeof (door_dp->audit_ap)); 135*0Sstevel@tonic-gate if (ret_val == -1) 136*0Sstevel@tonic-gate return (ret_val); 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate door_dp->audit_auid = door_dp->audit_ap.ap_auid; 139*0Sstevel@tonic-gate door_dp->audit_euid = client_cred.dc_euid; 140*0Sstevel@tonic-gate door_dp->audit_egid = client_cred.dc_egid; 141*0Sstevel@tonic-gate door_dp->audit_uid = client_cred.dc_ruid; 142*0Sstevel@tonic-gate door_dp->audit_gid = client_cred.dc_rgid; 143*0Sstevel@tonic-gate door_dp->audit_pid = client_cred.dc_pid; 144*0Sstevel@tonic-gate door_dp->audit_asid = door_dp->audit_ap.ap_asid; 145*0Sstevel@tonic-gate door_dp->audit_tid.at_port = door_dp->audit_ap.ap_termid.at_port; 146*0Sstevel@tonic-gate door_dp->audit_tid.at_type = door_dp->audit_ap.ap_termid.at_type; 147*0Sstevel@tonic-gate for (i = 0; i < (door_dp->audit_ap.ap_termid.at_type/4); i++) 148*0Sstevel@tonic-gate door_dp->audit_tid.at_addr[i] = 149*0Sstevel@tonic-gate door_dp->audit_ap.ap_termid.at_addr[i]; 150*0Sstevel@tonic-gate (void) audit_save_policy(door_dp); 151*0Sstevel@tonic-gate return (0); 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate /* 155*0Sstevel@tonic-gate * audit_save_namask(): 156*0Sstevel@tonic-gate * Save the namask using the naflags entry in the audit_control file. 157*0Sstevel@tonic-gate * Return 0 if successful. 158*0Sstevel@tonic-gate * Return -1, and don't change the namask, if failed. 159*0Sstevel@tonic-gate * Side Effect: Sets audit_na to -1 if error, 1 if successful. 160*0Sstevel@tonic-gate */ 161*0Sstevel@tonic-gate static int 162*0Sstevel@tonic-gate audit_save_namask(door_data_t *door_dp) 163*0Sstevel@tonic-gate { 164*0Sstevel@tonic-gate au_mask_t mask; 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate door_dp->audit_na = -1; 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate /* 169*0Sstevel@tonic-gate * get non-attributable system event mask from kernel. 170*0Sstevel@tonic-gate */ 171*0Sstevel@tonic-gate if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) { 172*0Sstevel@tonic-gate return (-1); 173*0Sstevel@tonic-gate } 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate door_dp->audit_namask.am_success = mask.am_success; 176*0Sstevel@tonic-gate door_dp->audit_namask.am_failure = mask.am_failure; 177*0Sstevel@tonic-gate door_dp->audit_na = 1; 178*0Sstevel@tonic-gate return (0); 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate /* 182*0Sstevel@tonic-gate * audit_audit: 183*0Sstevel@tonic-gate * Cut and audit record if it is selected. 184*0Sstevel@tonic-gate * Return 0, if successfully written. 185*0Sstevel@tonic-gate * Return 0, if not written, and not expected to write. 186*0Sstevel@tonic-gate * Return -1, if not written because of unexpected error. 187*0Sstevel@tonic-gate */ 188*0Sstevel@tonic-gate int 189*0Sstevel@tonic-gate audit_audit(door_data_t *door_dp) 190*0Sstevel@tonic-gate { 191*0Sstevel@tonic-gate int ad; 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate if (can_audit() == 0) { 194*0Sstevel@tonic-gate return (0); 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate if (door_dp->audit_na) { 198*0Sstevel@tonic-gate if (!audit_na_selected(door_dp)) { 199*0Sstevel@tonic-gate return (0); 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate } else if (!audit_selected(door_dp)) { 202*0Sstevel@tonic-gate return (0); 203*0Sstevel@tonic-gate } 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate if ((ad = au_open()) == -1) { 206*0Sstevel@tonic-gate return (-1); 207*0Sstevel@tonic-gate } 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate (void) au_write(ad, au_to_subject_ex(door_dp->audit_auid, 210*0Sstevel@tonic-gate door_dp->audit_euid, 211*0Sstevel@tonic-gate door_dp->audit_egid, 212*0Sstevel@tonic-gate door_dp->audit_uid, door_dp->audit_gid, door_dp->audit_pid, 213*0Sstevel@tonic-gate door_dp->audit_asid, &door_dp->audit_tid)); 214*0Sstevel@tonic-gate if (door_dp->audit_policy & AUDIT_GROUP) { 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate int ng; 217*0Sstevel@tonic-gate gid_t grplst[NGROUPS_MAX]; 218*0Sstevel@tonic-gate 219*0Sstevel@tonic-gate (void) memset(grplst, 0, sizeof (grplst)); 220*0Sstevel@tonic-gate if ((ng = getgroups(NGROUPS_UMAX, grplst))) { 221*0Sstevel@tonic-gate (void) au_write(ad, au_to_newgroups(ng, grplst)); 222*0Sstevel@tonic-gate } 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate if (strlen(door_dp->audit_text) != 0) { 225*0Sstevel@tonic-gate (void) au_write(ad, au_to_text(door_dp->audit_text)); 226*0Sstevel@tonic-gate } 227*0Sstevel@tonic-gate if (strlen(door_dp->audit_text1) != 0) { 228*0Sstevel@tonic-gate (void) au_write(ad, au_to_text(door_dp->audit_text1)); 229*0Sstevel@tonic-gate } 230*0Sstevel@tonic-gate if (door_dp->audit_path != NULL) { 231*0Sstevel@tonic-gate (void) au_write(ad, au_to_path(door_dp->audit_path)); 232*0Sstevel@tonic-gate } 233*0Sstevel@tonic-gate #ifdef _LP64 234*0Sstevel@tonic-gate (void) au_write(ad, au_to_return64((door_dp->audit_sorf == 0) ? 0 : -1, 235*0Sstevel@tonic-gate (int64_t)door_dp->audit_sorf)); 236*0Sstevel@tonic-gate #else 237*0Sstevel@tonic-gate (void) au_write(ad, au_to_return32((door_dp->audit_sorf == 0) ? 0 : -1, 238*0Sstevel@tonic-gate (int32_t)door_dp->audit_sorf)); 239*0Sstevel@tonic-gate #endif 240*0Sstevel@tonic-gate if (au_close(ad, 1, door_dp->audit_event) < 0) { 241*0Sstevel@tonic-gate (void) au_close(ad, 0, 0); 242*0Sstevel@tonic-gate return (-1); 243*0Sstevel@tonic-gate } 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate return (0); 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate 248*0Sstevel@tonic-gate static int 249*0Sstevel@tonic-gate audit_na_selected(door_data_t *door_dp) 250*0Sstevel@tonic-gate { 251*0Sstevel@tonic-gate if (door_dp->audit_na == -1) { 252*0Sstevel@tonic-gate return (-1); 253*0Sstevel@tonic-gate } 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate return (selected(door_dp->audit_event, 256*0Sstevel@tonic-gate &door_dp->audit_namask, door_dp->audit_sorf)); 257*0Sstevel@tonic-gate } 258*0Sstevel@tonic-gate 259*0Sstevel@tonic-gate static int 260*0Sstevel@tonic-gate audit_selected(door_data_t *door_dp) 261*0Sstevel@tonic-gate { 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate if (door_dp->audit_uid < 0) { 264*0Sstevel@tonic-gate (void) audit_save_namask(door_dp); 265*0Sstevel@tonic-gate return (audit_na_selected(door_dp)); 266*0Sstevel@tonic-gate } 267*0Sstevel@tonic-gate 268*0Sstevel@tonic-gate return (selected(door_dp->audit_event, 269*0Sstevel@tonic-gate &door_dp->audit_ap.ap_mask, door_dp->audit_sorf)); 270*0Sstevel@tonic-gate } 271*0Sstevel@tonic-gate 272*0Sstevel@tonic-gate static int 273*0Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf) 274*0Sstevel@tonic-gate { 275*0Sstevel@tonic-gate int prs_sorf; 276*0Sstevel@tonic-gate 277*0Sstevel@tonic-gate if (sorf == 0) { 278*0Sstevel@tonic-gate prs_sorf = AU_PRS_SUCCESS; 279*0Sstevel@tonic-gate } else if (sorf == -1) { 280*0Sstevel@tonic-gate prs_sorf = AU_PRS_FAILURE; 281*0Sstevel@tonic-gate } else { 282*0Sstevel@tonic-gate prs_sorf = AU_PRS_BOTH; 283*0Sstevel@tonic-gate } 284*0Sstevel@tonic-gate 285*0Sstevel@tonic-gate return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD)); 286*0Sstevel@tonic-gate } 287